Sign Bundle with a Timestamp Authority by DarkaMaul · Pull Request #1216 · sigstore/sigstore-python

DarkaMaul · 2024-11-15T16:43:05Z

Final bit of #1182

Summary

This PR introduces the possibility to create a bundle with a timestamp signed by a TimestampAuthority.

Release Note

Added

If a Timestamp Authority URL has been provided in the SigningConfig, the bundle are now automatically generated with a signed timestamp.

/cc @woodruffw @facutuesca

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Co-authored-by: Facundo Tuesca <facu@tuesca.com> Signed-off-by: dm <darkamaul@hotmail.fr>

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

# Conflicts: # CHANGELOG.md # sigstore/dsse/__init__.py # sigstore/verify/verifier.py # test/assets/tsa/bundle.txt.sigstore # test/unit/verify/test_verifier.py

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

sigstore/_internal/timestamp.py

test/unit/conftest.py

.github/workflows/ci.yml

Co-authored-by: William Woodruff <william@yossarian.net> Signed-off-by: dm <darkamaul@hotmail.fr>

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

jku · 2024-11-18T15:37:22Z

/gcbrun

woodruffw · 2024-11-18T15:52:49Z

This looks like something bad on the Windows CI:

    Error configuring OpenSSL build:
        'perl' reported failure with exit code: 2
        Command failed: "perl" "./Configure" "--prefix=C:/Users/runneradmin/AppData/Local/Temp/pip-install-ldkkdr4i/rfc3161-client_a9d25b6f62a14f8aac4a34a83ab37a09/rust/target/release/build/openssl-sys-b380da04be89fe31/out/openssl-build/install" "--openssldir=SYS$MANAGER:[OPENSSL]" "no-shared" "no-ssl3" "no-tests" "no-comp" "no-zlib" "no-zlib-dynamic" "--libdir=lib" "no-md2" "no-rc5" "no-weak-ssl-ciphers" "no-camellia" "no-idea" "no-seed" "no-capieng" "no-asm" "VC-WIN64A"

jku · 2024-11-18T15:58:46Z

This looks like something bad on the Windows CI

I think this might require some of the same build config tricks that rfc3161-client CI has... alternatively maybe wait for a rfc3161-client release and avoid installing from git

woodruffw · 2024-11-18T16:09:52Z

This looks like something bad on the Windows CI

I think this might require some of the same build config tricks that rfc3161-client CI has... alternatively maybe wait for a rfc3161-client release and avoid installing from git

Yeah, I think we can prep another release. CC @DarkaMaul

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

jku · 2024-11-20T15:52:11Z

/gcbrun

.github/workflows/ci.yml

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

woodruffw · 2024-11-25T15:43:40Z

/gcbrun

woodruffw · 2024-11-25T17:04:28Z

.github/workflows/ci.yml

+          make test TEST_ARGS="-m timestamp_authority -rs" | tee output
+          ! grep -q "skipping test that requires a Timestamp Authority" output || (echo "ERROR: Found skip message" && exit 1)
+        env:
+          SIGSTORE_TIMESTAMP: "v1.2.3"


I don't love that we pull down a binary here, and hardcode the version. It'd be great if we could get this into Dependabot somehow.

(Not a blocker, flagging as a follow-up.)

woodruffw · 2024-11-25T17:07:10Z

sigstore/sign.py

+        fulcio: FulcioClient,
+        rekor: RekorClient,
+        trusted_root: TrustedRoot,
+        tsa_clients: List[TimestampAuthorityClient] | None = None,


Flagging: it's not ideal that this parameter list continues to grow; I think we could probably slice it down substantially by passing the entire ClientTrustConfig and doing the instantiations internally.

That'd be good for a follow-on refactor PR here.

woodruffw

LGTM, nice work @DarkaMaul!

I left some non-blocking comments; the one about refactoring SigningContext's ctor in particular would be good for a follow-up PR.

woodruffw · 2024-11-25T17:09:06Z

This also needs a CHANGELOG entry, but I'm going to merge as-is and do a follow-up for that.

woodruffw · 2024-11-25T17:09:20Z

/gcbrun

Signed-off-by: William Woodruff <william@trailofbits.com>

DarkaMaul and others added 16 commits November 7, 2024 09:32

Add tests for CertificateAuthority

c7de7db

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Add root requirement for CA

ac0fa7e

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Timestamp Verification

cc16b31

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Add signature on Bundle and Envelope

9a1bbf4

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Start to improve tests.

f686f53

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Improve testing

86e4885

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Improve tests

8d95387

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Add CHANGELOG entry

9f9adf8

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Fix test

303210f

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Fix _verify_signed_timestamp return value.

7733a9b

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Use a Signed Timestamp within a bundle

dc6545c

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Refactor client timeout as constant

e0c10e5

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Apply suggestions from code review

e0e5f6d

Co-authored-by: Facundo Tuesca <facu@tuesca.com> Signed-off-by: dm <darkamaul@hotmail.fr>

Rename method to request_timestamp

b28a849

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Merge branch 'main' into dm/timestamp-signing

1684b74

# Conflicts: # CHANGELOG.md # sigstore/dsse/__init__.py # sigstore/verify/verifier.py # test/assets/tsa/bundle.txt.sigstore # test/unit/verify/test_verifier.py

Use add_root_certificate

b4744dd

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

woodruffw reviewed Nov 15, 2024

View reviewed changes

sigstore/_internal/timestamp.py Outdated Show resolved Hide resolved

woodruffw reviewed Nov 15, 2024

View reviewed changes

test/unit/conftest.py Outdated Show resolved Hide resolved

woodruffw reviewed Nov 15, 2024

View reviewed changes

.github/workflows/ci.yml Outdated Show resolved Hide resolved

DarkaMaul and others added 4 commits November 18, 2024 15:27

Update .github/workflows/ci.yml

e18f80f

Co-authored-by: William Woodruff <william@yossarian.net> Signed-off-by: dm <darkamaul@hotmail.fr>

Update test/unit/conftest.py

ad1d6f1

Co-authored-by: William Woodruff <william@yossarian.net> Signed-off-by: dm <darkamaul@hotmail.fr>

Merge branch 'main' into dm/timestamp-signing

3f7146b

Reduce timeout

f2c2124

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

DarkaMaul added 3 commits November 20, 2024 09:23

Use new release of rfc3161-client

9de30ed

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Merge branch 'main' into dm/timestamp-signing

dae1fc2

Make sure Timestamp tests are effectively run.

4272a5b

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

woodruffw reviewed Nov 20, 2024

View reviewed changes

.github/workflows/ci.yml Show resolved Hide resolved

DarkaMaul added 2 commits November 20, 2024 18:03

Better document failure cases in tests

5c4dc68

Signed-off-by: Alexis <alexis.challande@trailofbits.com>

Merge branch 'main' into dm/timestamp-signing

c5abd36

woodruffw reviewed Nov 25, 2024

View reviewed changes

woodruffw approved these changes Nov 25, 2024

View reviewed changes

woodruffw added component:signing Core signing functionality component:api Public APIs labels Nov 25, 2024

Merge branch 'main' into dm/timestamp-signing

fcc890a

woodruffw enabled auto-merge (squash) November 25, 2024 17:09

woodruffw merged commit 383797a into sigstore:main Nov 25, 2024

woodruffw deleted the dm/timestamp-signing branch November 25, 2024 17:14

woodruffw added a commit that referenced this pull request Nov 25, 2024

CHANGELOG: record #1216

21ad848

Signed-off-by: William Woodruff <william@trailofbits.com>

DarkaMaul mentioned this pull request Nov 26, 2024

Update Sigstore Timestamp using dependabot #1225

Merged

woodruffw added a commit that referenced this pull request Nov 26, 2024

CHANGELOG: record #1216 (#1224)

3caf36f

Conversation

DarkaMaul commented Nov 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Release Note

Added

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jku commented Nov 18, 2024

Uh oh!

woodruffw commented Nov 18, 2024

Uh oh!

jku commented Nov 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

woodruffw commented Nov 18, 2024

Uh oh!

jku commented Nov 20, 2024

Uh oh!

Uh oh!

woodruffw commented Nov 25, 2024

Uh oh!

woodruffw Nov 25, 2024

Choose a reason for hiding this comment

Uh oh!

woodruffw Nov 25, 2024

Choose a reason for hiding this comment

Uh oh!

woodruffw left a comment

Choose a reason for hiding this comment

Uh oh!

woodruffw commented Nov 25, 2024

Uh oh!

woodruffw commented Nov 25, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

DarkaMaul commented Nov 15, 2024 •

edited

Loading

jku commented Nov 18, 2024 •

edited

Loading